Submission Details
Impact:
Likelihood:
Principal can set favorable and unfavorable `cutOffScore` for students in `LevelOne::startSession`
Summary
As it stands, the system is built for the maximum score of a student to be 100, since a bad review deducts 10. The principal can set a score above 100 to ensure that no student passes, since there's no range check.
Impact
No student passes even if they get good reviews for all 4 weeks.
Tools Used
Manual Review
Recommendations
Add a range check for cut-off score provided by the principal:
function startSession(
uint256 _cutOffScore
) public onlyPrincipal notYetInSession {
+ require(_cutOffScore >=70 && _cutOffScore <=100, "Invalid cut off score");
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore; // there should be a range check for this
emit SchoolInSession(block.timestamp, sessionEnd);
}
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.